terraform {
  required_version = "< 2.0.0"
  backend "pg" {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "internal_zitadel"
  }

  required_providers {
    zitadel = {
      source  = "zitadel/zitadel"
      version = "~> 3.4"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.8"
    }
  }
}

# VAULT_ADDR and VAULT_TOKEN are read from the environment.
provider "vault" {}

provider "random" {}

ephemeral "vault_kv_secret_v2" "zitadel_iam_admin" {
  mount = var.vault_kv_mount
  name  = var.zitadel_iam_admin_vault_path
}

locals {
  zitadel_iam_admin_machine_key_json = ephemeral.vault_kv_secret_v2.zitadel_iam_admin.data[var.zitadel_iam_admin_machine_key_key]
}

provider "zitadel" {
  domain           = var.zitadel_domain
  port             = "443"
  insecure         = false
  jwt_profile_json = local.zitadel_iam_admin_machine_key_json
}

variable "zitadel_domain" {
  description = "External DNS name for the ZITADEL instance."
  type        = string
  default     = "auth.quorate.dev"
}

variable "zitadel_iam_admin_vault_path" {
  description = "Vault KV path containing the ZITADEL IAM admin machine-key JSON."
  type        = string
  default     = "zitadel/iam-admin"
}

variable "zitadel_iam_admin_machine_key_key" {
  description = "Key in zitadel_iam_admin_vault_path containing the ZITADEL IAM admin machine-key JSON."
  type        = string
  default     = "iam-admin.json"
}